Merge pull request #1172 from amvanbaren/issue-1171

Fix CVE-2025-22228

Author: amvanbaren

server/build.gradle

@@ -11,7 +11,7 @@ plugins {
     id 'jacoco'
     id 'nu.studer.jooq' version '8.2.1'
     id 'de.undercouch.download' version '5.4.0'
-    id 'org.springframework.boot' version '3.2.4'
+    id 'org.springframework.boot' version '3.3.10'
     id 'io.spring.dependency-management' version '1.1.0'
     id 'io.gatling.gradle' version '3.9.5'
     id 'java'

server/src/main/java/org/eclipse/openvsx/search/DatabaseSearchService.java

@@ -62,7 +62,7 @@ public SearchHits<ExtensionSearch> search(ISearchService.Options options) {
 
         // no extensions in the database
         if (matchingExtensions.isEmpty()) {
-            return new SearchHitsImpl<>(0,TotalHitsRelation.OFF, 0f, null, null, Collections.emptyList(), null, null);
+            return new SearchHitsImpl<>(0,TotalHitsRelation.OFF, 0f, null, null, Collections.emptyList(), null, null, null);
         }
 
         // exlude namespaces
@@ -148,7 +148,7 @@ public SearchHits<ExtensionSearch> search(ISearchService.Options options) {
             searchHits = sortedExtensions.stream().map(extensionSearch -> new SearchHit<>(null, null, null, 0.0f, null, null, null, null, null, null, extensionSearch)).collect(Collectors.toList());
         }
 
-        return new SearchHitsImpl<>(totalHits, TotalHitsRelation.OFF, 0f, null, null, searchHits, null, null);
+        return new SearchHitsImpl<>(totalHits, TotalHitsRelation.OFF, 0f, null, null, searchHits, null, null, null);
     }
 
     @Override

server/src/main/java/org/eclipse/openvsx/search/ElasticSearchService.java

@@ -248,7 +248,7 @@ public void removeSearchEntry(Extension extension) {
     public SearchHits<ExtensionSearch> search(Options options) {
         var resultWindow = options.requestedOffset() + options.requestedSize();
         if(resultWindow > getMaxResultWindow()) {
-            return new SearchHitsImpl<>(0, TotalHitsRelation.OFF, 0f, null, null, Collections.emptyList(), null, null);
+            return new SearchHitsImpl<>(0, TotalHitsRelation.OFF, 0f, null, null, Collections.emptyList(), null, null, null);
         }
 
         var queryBuilder = new NativeQueryBuilder();
@@ -294,6 +294,7 @@ public SearchHits<ExtensionSearch> search(Options options) {
                     null,
                     searchHits,
                     null,
+                    null,
                     null
             );
         } else {

server/src/test/java/org/eclipse/openvsx/RegistryAPITest.java

@@ -2184,7 +2184,7 @@ private List<ExtensionVersion> mockSearch() {
         var entry1 = new ExtensionSearch();
         entry1.setId(1);
         var searchHit = new SearchHit<>("0", "1", null, 1.0f, null, null, null, null, null, null, entry1);
-        var searchHits = new SearchHitsImpl<>(1, TotalHitsRelation.EQUAL_TO, 1.0f, "1", null, List.of(searchHit), null, null);
+        var searchHits = new SearchHitsImpl<>(1, TotalHitsRelation.EQUAL_TO, 1.0f, "1", null, List.of(searchHit), null, null, null);
         Mockito.when(search.isEnabled())
                 .thenReturn(true);
         var searchOptions = new ISearchService.Options("foo", null, null, 10, 0, "desc", "relevance", false, null);

server/src/test/java/org/eclipse/openvsx/adapter/VSCodeAPITest.java

@@ -633,7 +633,7 @@ private Extension mockSearch(String targetPlatform, String namespaceName, boolea
                 ? Collections.singletonList(new SearchHit<>("0", "1", null, 1.0f, null, null, null, null, null, null, entry1))
                 : Collections.emptyList();
         var searchHits = new SearchHitsImpl<>(searchResults.size(), TotalHitsRelation.EQUAL_TO, 1.0f, "1", null,
-                searchResults, null, null);
+                searchResults, null, null, null);
 
         Mockito.when(integrityService.isEnabled())
                 .thenReturn(true);